When DNA from hundreds of people is pooled together, it has been impossible to identify any individuals. In what could be a boon for crime-fighters, however, a statistical technique now makes the task possible--allowing forensic detectives to determine whether a suspect handled a gun, for example.

But the technique also creates a privacy concern about health data; the National Institutes of Health (NIH) in Bethesda, Maryland, is now backpedaling on a policy mandating genetic sharing developed just 8 months ago for fear that the health information of people who participated in the studies could be identified.

The authors of the paper, which appears in the 29 August issue of PLoS Genetics, work on large genome-wide association studies. Researchers hunting for disease genes will scan the genomes of many people with and without, say, cancer, combing through a pool of hundreds of thousands of DNA variants. These studies frequently combine DNA from hundreds of individuals to try to discern patterns of inheritance in a population--what percentage carry a version of a gene that might predispose to heart attacks, for example, and what percentage carry another, less harmful version. "People have always asked us, 'Could you unpool' " once the DNA has been mixed, says geneticist David Craig of the Translational Genomics Research Institute in Phoenix, Arizona. "It really is a forensics question."

To find out, Craig and his colleagues developed a mathematical strategy to search the pool for DNA variants called single-nucleotide polymorphisms from a known individual. NIH scientists have replicated the work, and officials there say the paper raises serious privacy issues. Currently, the agency asks scientists to post pooled data on its Web site for anyone to access. Not anymore. Late last week and early this week, NIH pulled the pooled data from its Web site. "We were concerned," says Elizabeth Nabel, who chairs the committee that oversees genome-wide association studies, as well as heads the National Heart, Lung, and Blood Institute.

The gravest worry was that an individual who had someone's genetic code could determine, based on the pooled data, whether the person participated in a disease study and whether they were in the disease group, or thereby glean private health information. NIH plans to ask institutions that have posted pooled data on their own Web sites to take these down, too.

Meanwhile, Craig says the work also has implications for forensics, offering detectives a way to identify whether a suspect has handled a weapon, for example, that was touched by many others. "This wouldn't be the final thing in a court of law," he says, "but it would give them the reason" to investigate further.